[cups.general] Managing a SMB queue through CUPS

Mon Jan 21 04:39:46 PST 2008

On Thu, 17 Jan 2008, Michael R Sweet wrote:

> You *can* use IPP with Windows 2000 and higher using http: or https:
> URIs of the form:
>
>     {http|https}://host-or-ip/printers/sharename/.printer
>
> That will give you *slightly* more reliable printing, but means you
> need to have IIS and the IPP support enabled on your server which
> exposes you to additional security risks on the Windows box...

I've configured Kerberos with IPP on Windows Server 2003.  I can merrily
browse to it with firefox on linux and have it authenticate, and have verified
this is definitely the case using wireshark.

Now for setting cups up (as I was planning on having:

cups client -> cups server -> windows server.

I've joined the CUPS machine to the same domain, created and ipp
ServicePrincipal.  As a user I can authenticate with Kerberos to the cups
server.

But the ipp backend is then not using kerberos to talk to the Windows 2003
Server.

Am I missing something really obvious?

LOG snippets:

D [21/Jan/2008:12:23:25 +0000] [Job 31] argv[0]="test"
D [21/Jan/2008:12:23:25 +0000] [Job 31] argv[1]="31"
D [21/Jan/2008:12:23:25 +0000] [Job 31] argv[2]="johnh at OUR.DOMAIN"
D [21/Jan/2008:12:23:25 +0000] [Job 31] argv[3]="testprint.ps"
D [21/Jan/2008:12:23:25 +0000] [Job 31] argv[4]="1"
D [21/Jan/2008:12:23:25 +0000] [Job 31] argv[5]="media=A4 sides=one-sided finishings=3 number-up=1 job-uuid=urn:uuid:7ce1e9f9-1bf6-32dd-476e-6925e2be5056"
D [21/Jan/2008:12:23:25 +0000] [Job 31] argv[6]="/var/spool/cups/d00031-001"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[0]="CUPS_CACHEDIR=/var/cache/cups"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[1]="CUPS_DATADIR=/usr/share/cups"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[2]="CUPS_DOCROOT=/usr/share/doc/cups-1.3.5"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[3]="CUPS_FONTPATH=/usr/share/cups/fonts"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[4]="CUPS_REQUESTROOT=/var/spool/cups"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[5]="CUPS_SERVERBIN=/usr/lib/cups"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[6]="CUPS_SERVERROOT=/etc/cups"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[7]="CUPS_STATEDIR=/var/run/cups"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[8]="PATH=/usr/lib/cups/filter:/usr/lib64/cups/filter:/usr/bin:/usr/sbin:/bin:/usr/bin"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[9]="SERVER_ADMIN=root at server.our.domain"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[10]="SOFTWARE=CUPS/1.3.5"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[11]="TMPDIR=/var/spool/cups/tmp"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[12]="USER=root"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[13]="CUPS_SERVER=localhost"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[14]="CUPS_ENCRYPTION=IfRequested"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[15]="IPP_PORT=631"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[16]="CHARSET=utf-8"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[17]="LANG=en_GB.UTF8"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[18]="PPD=/etc/cups/ppd/test.ppd"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[19]="RIP_MAX_CACHE=8m"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[20]="CONTENT_TYPE=application/postscript"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[21]="DEVICE_URI=http://windowsserver.ourdomain:80/printers/irilex1/.printer"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[22]="PRINTER=test"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[23]="FINAL_CONTENT_TYPE=printer/test"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[24]="AUTH_U****"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[25]="AUTH_P****"
D [21/Jan/2008:12:23:25 +0000] [Job 31] envp[26]="KRB5CCNAME=FILE:/tmp/tktSD9WmP"
I [21/Jan/2008:12:23:25 +0000] [Job 31] Started filter /usr/lib/cups/filter/pstops (PID 32274)
I [21/Jan/2008:12:23:25 +0000] [Job 31] Started filter /usr/lib/cups/filter/foomatic-rip (PID 32275)
I [21/Jan/2008:12:23:25 +0000] [Job 31] Started backend /usr/lib/cups/backend/http (PID 32276)

All looks correct, ticket present and correct in /tmp/tktSD9WmP.  But that all
bails out with:

D [21/Jan/2008:12:23:25 +0000] PID 32275 (/usr/lib/cups/filter/foomatic-rip) exited with no errors.
D [21/Jan/2008:12:23:25 +0000] [Job 31] 1 files to send in job...
D [21/Jan/2008:12:23:25 +0000] Discarding unused printer-state-changed event...
D [21/Jan/2008:12:23:25 +0000] Discarding unused printer-state-changed event...
D [21/Jan/2008:12:23:25 +0000] Discarding unused printer-state-changed event...
D [21/Jan/2008:12:23:25 +0000] [Job 31] Connected to 192.168.0.1:80 (IPv4)...
D [21/Jan/2008:12:23:25 +0000] [Job 31] Getting supported attributes...
E [21/Jan/2008:12:23:25 +0000] [Job 31] Unable to get printer status (Unauthorized)!
D [21/Jan/2008:12:23:25 +0000] Discarding unused printer-state-changed event...
D [21/Jan/2008:12:23:35 +0000] [Job 31] Getting supported attributes...
E [21/Jan/2008:12:23:35 +0000] [Job 31] Unable to get printer status (Unauthorized)!
D [21/Jan/2008:12:23:35 +0000] Discarding unused printer-state-changed event...
D [21/Jan/2008:12:23:45 +0000] [Job 31] Getting supported attributes...
E [21/Jan/2008:12:23:45 +0000] [Job 31] Unable to get printer status (Unauthorized)!
D [21/Jan/2008:12:23:45 +0000] Discarding unused printer-state-changed event...
D [21/Jan/2008:12:23:46 +0000] [Job 30] Unloading...
D [21/Jan/2008:12:23:55 +0000] [Job 31] Getting supported attributes...
I [21/Jan/2008:12:23:55 +0000] Saving printers.conf...
E [21/Jan/2008:12:23:55 +0000] PID 32276 (/usr/lib/cups/backend/http) stopped with status 2!
D [21/Jan/2008:12:23:55 +0000] [Job 31] File 0 is complete.
I [21/Jan/2008:12:23:55 +0000] [Job 31] Backend returned status 2 (authentication required)
D [21/Jan/2008:12:23:55 +0000] Discarding unused printer-state-changed event...
D [21/Jan/2008:12:23:55 +0000] Discarding unused job-stopped event...

jh

-- 
"Tact in audacity consists in knowing how far we may go too far."
                                                      -- Jean Cocteau